Skip to content

Oracle patches 98 MySQL bugs, 29 of them need no login at all

Oracle's October Critical Patch Update, out today, fixes 98 MySQL vulnerabilities with a top CVSS score of 9.8. None are confirmed exploited yet, but the clock is ticking.

Source: Oracle

Oracle’s quarterly Critical Patch Update landed today, 20 October, and MySQL accounts for 98 of the new security patches in it. Twenty-nine of those bugs are remotely exploitable without authentication, and the highest CVSS v3.1 base score among them is 9.8, as severe as the scale goes.

The affected list spans MySQL Server, Client, Cluster and Connectors across versions 8.0.0 to 8.0.48, 8.4.0 to 8.4.11, 9.7.0 to 9.7.2 and 26.7.0, so both the long-term 8.0 line and the newer innovation releases need attention. Oracle’s advisory doesn’t flag any of the 98 as currently exploited.

Why it matters: an unauthenticated, critical-severity bug in a database engine this widely run is exactly the profile attackers reverse-engineer from the patch diff within days of release. If you run MySQL yourself rather than through a managed service that patches on your behalf, this is worth scheduling this week, not next quarter.

The caveat: Oracle’s summary gives the patch count and top CVSS score per product but doesn’t say which specific CVEs are the unauthenticated, 9.8 ones, so you still need the full risk matrix to know whether your exact version and configuration are exposed.

Share

Related reading

Engineering

How to patch PHP in a hurry without breaking production

PHP ships an out-of-band fix for two critical flaws at 14:00 UTC today. Here is the hour of preparation that turns the patch into a non-event, and the runbook for when it lands.

Engineering

The N+1 you cannot see

Everyone knows to eager load. The queries that actually take sites down are the ones hiding in an accessor, a Blade partial, or a policy. There is a one-line switch that finds all of them.

Engineering

Database indexes, explained with a phone book

Most slow queries are one index away from being fast. The reason people do not add it is that nobody ever explained what the index is actually doing.

More from The Wire

All briefs

GitLab patches a second CVSS 10.0 RCE in nine days

CVE-2026-110264 is an unauthenticated code execution bug in the Onigmo regex engine, reached through Org-mode file previews. It reaches back to 2014 and catches servers already patched for the 12 October flaw.

via GitLab

GitHub's new Copilot default policy takes effect today

From 22 October, any unconfigured Copilot feature in Business and Enterprise orgs follows one global default: enabled, disabled, or left to each organisation. Admins had a 28-day window to set it before this landed.

via GitHub